@bongos/core 1.20.79 → 1.20.81

package/release-notes.json

@@ -8615,5 +8615,21 @@
       "id": "1004484",
       "text": "New projects no longer have their 'start' command pointing at the Bongos hall, so when an owner later connects Render with the usual 'npm start', it runs their app instead of a broken second copy of the hall."
     }
+  ],
+  "1.20.80": [
+    {
+      "id": "1004298",
+      "text": "New versions can now run on Bongos first and reach other projects only when the owner presses Release on the deploy page, which shows how long each version has run on Bongos and whether it was ever rolled back. Switched off un"
+    },
+    {
+      "id": "1003907",
+      "text": "Autobongos has now been proven against the live project: it shipped work by itself with nobody watching, refused every kind of work it is not allowed to touch, and recovered from restarts and network failures on its own. The o"
+    }
+  ],
+  "1.20.81": [
+    {
+      "id": "1004501",
+      "text": "Each builder now chooses which goals their own Autobongos runner works, in Settings, from the goals the project allows. A builder who chooses nothing gets no unattended work. Who may run a runner at all is now a project permis"
+    }
   ]
 }

package/scripts/gds/provision-core-upgrade.js

@@ -166,6 +166,34 @@ function instanceChannel(inst, channelMod) {
   return channelMod.normalizeChannel(inst && inst.update_channel != null ? inst.update_channel : channelMod.DEFAULT_CHANNEL);
 }
 
+// The versions this project may be moved to: the published ones its FOLLOW admits (task 1004298,
+// ADR 0361). The platform hall (control-plane) takes every candidate; every other project only what
+// has been released, and NOTHING when the registry cannot say which version that is — a project that
+// follows releases is never moved on a guess. A channel module without the follow (an old core
+// resolved at drain time) offers the whole list, which is what every version meant before candidates.
+//
+// The released label is one fact about the registry, the same for every project in a pass, and
+// reading it is a blocking `npm view`. So it is read once per channel module per RELEASE_TAGS_TTL_MS
+// and shared: a pass over N projects costs one extra subprocess, not N. A failed read is not kept.
+const RELEASE_TAGS_TTL_MS = 60 * 1000;
+const releaseTagsMemo = new WeakMap();
+function releaseTagsFor(channelMod, instanceDir, now = Date.now()) {
+  const hit = releaseTagsMemo.get(channelMod);
+  if (hit && now - hit.at < RELEASE_TAGS_TTL_MS) return hit.tags;
+  const tags = channelMod.readReleaseTags({ cwd: instanceDir });
+  if (tags && tags.ok) releaseTagsMemo.set(channelMod, { at: now, tags });
+  return tags;
+}
+
+function offeredVersions(channelMod, inst, instanceDir) {
+  const listed = channelMod.listAvailableVersions({ cwd: instanceDir });
+  if (!listed || !listed.ok || typeof channelMod.followForShape !== 'function') return listed;
+  if (channelMod.followForShape(inst && inst.hosting_shape) === 'candidates') return listed;
+  const tags = releaseTagsFor(channelMod, instanceDir);
+  if (!tags.ok) return { ok: false, error: `could not read which version is released (${tags.error})`, versions: [] };
+  return { ok: true, versions: channelMod.versionsForFollow({ follow: 'released', available: listed.versions, released: tags.released }) };
+}
+
 // A classified refusal (task 1004446): the drain loop stores `failure` beside last_error,
 // so the rest of the self-heal chain acts on a class, not on a sentence. PURE.
 function failed(reason, error, extra = {}) {
@@ -246,7 +274,7 @@ async function coreUpgradeInstance(inst, deps, intent) {
   // pointed at nothing. A row from before the column (undefined) still normalises to that
   // default, so an old runner schema reads exactly as it always did.
   const channel = instanceChannel(inst, channelMod);
-  const listed = channelMod.listAvailableVersions({ cwd: instanceDir });
+  const listed = offeredVersions(channelMod, inst, instanceDir);
   const available = (listed && listed.versions) || [];
   const fault = targetFault(to, available, installed, channel, channelMod.channelAllows);
   if (fault) return failed(outcome.runnerReason(fault), fault);
@@ -1013,7 +1041,7 @@ async function snapshotCoreVersions(inst, deps) {
     const body = probe && !probe.softFailed ? (probe.stdout || '') : null;
     const served = parseServedVersion(body);
     const schemaPending = parseSchemaPending(body);
-    const listed = channelMod.listAvailableVersions({ cwd: instanceDir });
+    const listed = offeredVersions(channelMod, inst, instanceDir);
     const available = (listed && listed.versions) || [];
     // What the channel would take FROM the version the box is actually on. Resolving it
     // here rather than in the browser is what keeps the button's promise and the

package/scripts/gds/release-core.js

@@ -0,0 +1,80 @@
+#!/usr/bin/env node
+'use strict';
+// scripts/gds/release-core.js — may this version of @bongos/core be RELEASED? (task 1004298, ADR 0361)
+//
+// Merges publish as candidates (under the `next` label). A version reaches other projects only when
+// the owner presses Release on /deploy, which runs publish.yml's release job, which asks this script
+// and then moves the registry's `latest` label. Every consumer that offers a version to a project
+// other than the platform hall reads `latest` (update-channel.js versionsForFollow), so this label IS
+// the release.
+//
+// WHY A SCRIPT AND NOT A SHELL STEP. The rule has four ways to say no, and a shell `if` chain inside
+// a workflow file is the one place nothing can test it. The decision is pure and unit-tested
+// (tests/release_core.mjs); the workflow only runs it and acts on `go`.
+//
+// THE RULE:
+//   - the version must be a plain x.y.z (it is interpolated into an npm command line);
+//   - it must be PUBLISHED — Release labels a version, it never builds one;
+//   - it must be newer than the current release. Releasing an OLDER version would move every
+//     project's offer backwards, which is a rollback for everyone, not a release; that is a
+//     different act and needs a person at a terminal, not a button.
+//   - releasing the version already released is a no-op, not an error — a double press is harmless.
+//
+// Usage (in publish.yml's release job):
+//   node scripts/gds/release-core.js --version 1.20.80
+// Prints the decision; writes go=true|false to $GITHUB_OUTPUT when set. Exit 0 for go and no-op,
+// 1 for a refusal.
+
+const fs = require('node:fs');
+const { spawnSync } = require('node:child_process');
+const { CORE_PKG, parseSemver, compareSemver, isStable } = require('./update-channel.js');
+
+const VERSION_RE = /^[0-9]+\.[0-9]+\.[0-9]+$/;
+
+/**
+ * PURE. `versions`: every published version. `latest`: the version the registry labels `latest`
+ * now, or null. Returns { go, noop, reason }.
+ */
+function releaseDecision({ version, versions, latest } = {}) {
+  const v = String(version == null ? '' : version).trim();
+  if (!VERSION_RE.test(v)) return { go: false, noop: false, reason: `"${v}" is not a version (x.y.z)` };
+  const list = Array.isArray(versions) ? versions : [];
+  if (!list.includes(v)) return { go: false, noop: false, reason: `${v} is not published — Release labels a published version, it never builds one` };
+  if (!isStable(v)) return { go: false, noop: false, reason: `${v} is a prerelease` };
+  if (latest && parseSemver(latest)) {
+    const c = compareSemver(v, latest);
+    if (c === 0) return { go: false, noop: true, reason: `${v} is already the release` };
+    if (c < 0) return { go: false, noop: false, reason: `${v} is older than the current release ${latest} — releasing it would move every project backwards` };
+  }
+  return { go: true, noop: false, reason: latest ? `release ${v} (was ${latest})` : `release ${v} (no release yet)` };
+}
+
+function readRegistry({ pkg = CORE_PKG, run = spawnSync } = {}) {
+  const res = run('npm', ['view', pkg, 'versions', 'dist-tags', '--json'], { encoding: 'utf8', timeout: 60000 });
+  if (!res || res.status !== 0) return { ok: false, error: String((res && res.stderr) || 'npm view failed').trim().split('\n')[0] };
+  try {
+    const doc = JSON.parse(String(res.stdout || '{}'));
+    const versions = Array.isArray(doc.versions) ? doc.versions : (typeof doc.versions === 'string' ? [doc.versions] : []);
+    const tags = doc['dist-tags'] || {};
+    return { ok: true, versions, latest: typeof tags.latest === 'string' ? tags.latest : null };
+  } catch (e) {
+    return { ok: false, error: `unparseable npm output: ${e.message}` };
+  }
+}
+
+function main(argv = process.argv.slice(2), { env = process.env, read = readRegistry, log = console.log, err = console.error } = {}) {
+  const i = argv.indexOf('--version');
+  const version = i >= 0 ? argv[i + 1] : '';
+  const out = (go) => { if (env.GITHUB_OUTPUT) fs.appendFileSync(env.GITHUB_OUTPUT, `go=${go}\n`); };
+  const reg = read();
+  if (!reg.ok) { err(`release-core: could not read the registry (${reg.error})`); out(false); return 1; }
+  const d = releaseDecision({ version, versions: reg.versions, latest: reg.latest });
+  out(d.go);
+  if (d.go || d.noop) { log(`release-core: ${d.reason}`); return 0; }
+  err(`release-core: refused — ${d.reason}`);
+  return 1;
+}
+
+if (require.main === module) process.exit(main());
+
+module.exports = { releaseDecision, main };

package/scripts/gds/update-channel.js

@@ -23,9 +23,9 @@
 //                has released to other projects. DEFAULT, for every project.
 //   candidates — every published version, the moment it is published. The platform's own hall, and
 //                only it: Bongos runs each version before anyone else is offered it.
-// The channel bounds how FAR a jump may go; the follow bounds which versions exist to jump to. Until
-// candidates publish under their own label (task 1004298), `latest` is the newest version and the two
-// follows pick the same target — the axis exists first so that the split changes nothing for Bongos.
+// The channel bounds how FAR a jump may go; the follow bounds which versions exist to jump to. Once
+// merges publish as candidates (task 1004298, ADR 0361), `latest` moves only when the owner presses
+// Release, so the two follows part: the platform hall takes each candidate, everyone else the release.
 //
 // WHY the registry as the source (not vendored tarballs): a subscription needs a LIVE source of
 // truth for "what's the newest published core?" — that's `npm view @bongos/core versions` against the
@@ -139,6 +139,14 @@ function versionsForFollow({ follow, available, released } = {}) {
   return list.filter((v) => compareSemver(v, released) <= 0);
 }
 
+// The follow a provisioned project takes, from its hosting shape (task 1004298, ADR 0361). The
+// control-plane row IS the platform's own hall, the one project that runs every candidate; every other
+// shape follows releases. Derived, not stored: there is exactly one platform hall, and a column an
+// operator could set on a tenant would be one more way to hand a project an unreleased version.
+function followForShape(hostingShape) {
+  return hostingShape === 'control-plane' ? 'candidates' : DEFAULT_FOLLOW;
+}
+
 // Would `channel` permit an unattended jump from `installed` to `candidate`? True only when candidate
 // is a STABLE release strictly newer than installed AND within the channel's blast radius. Any invalid
 // input, an unknown installed version, a prerelease candidate, or a major bump ⇒ false (fail-closed).
@@ -463,6 +471,7 @@ module.exports = {
   normalizeFollow,
   versionsForFollow,
   readReleaseTags,
+  followForShape,
   SUBSCRIPTIONS_REL,
   parseSemver,
   isStable,

package/src/bongos/core-update.js

@@ -25,6 +25,12 @@
 // OWN function (scripts/gds/update-channel.js) and is imported, not copied: the
 // banner must never offer a version the runner would then refuse, and ADR 0280
 // is the record of what a second copy of this contract costs when it drifts.
+//
+// ONLY RELEASED VERSIONS ARE OFFERED (task 1004298, ADR 0361). Merges publish as candidates; a
+// version reaches other projects when the owner presses Release, which moves the registry's
+// `latest` label. So the banner offers versions at or below `latest` (versionsForFollow, the same
+// function the sweep uses), and with no readable label it has no answer rather than offering a
+// candidate. The platform hall runs ahead of `latest` by design, so it simply reads "current".
 
 const https = require('node:https');
 const {
@@ -32,6 +38,7 @@ const {
   DEFAULT_CHANNEL,
   normalizeChannel,
   resolveChannelTarget,
+  versionsForFollow,
 } = require('../../scripts/gds/update-channel.js');
 
 const REGISTRY_ORIGIN = 'https://registry.npmjs.org';
@@ -50,9 +57,9 @@ const FETCH_TIMEOUT_MS = 4000;
  * same field for the same reason; the failure it prevents is a project that is
  * months behind being told, confidently, that it is current.
  */
-function coreUpdateVerdict({ running, available, channel } = {}) {
+function coreUpdateVerdict({ running, available, released, channel } = {}) {
   const ch = normalizeChannel(channel == null ? DEFAULT_CHANNEL : channel);
-  const versions = Array.isArray(available) ? available.filter((v) => typeof v === 'string') : [];
+  const versions = versionsForFollow({ follow: 'released', available, released });
   if (!running || typeof running !== 'string' || !versions.length) {
     return { running: running || null, latest: null, behind: false, reading: 'no_answer', channel: ch };
   }
@@ -88,7 +95,9 @@ function fetchPublishedVersions({ pkg = CORE_PKG, origin = REGISTRY_ORIGIN, time
           try {
             const doc = JSON.parse(body);
             const versions = Object.keys((doc && doc.versions) || {});
-            done(versions.length ? { ok: true, versions } : { ok: false, versions: [], error: 'no versions in packument' });
+            const tag = doc && doc['dist-tags'] && doc['dist-tags'].latest;
+            const released = typeof tag === 'string' ? tag : null;
+            done(versions.length ? { ok: true, versions, released } : { ok: false, versions: [], error: 'no versions in packument' });
           } catch (e) { done({ ok: false, versions: [], error: `unparseable packument: ${e.message}` }); }
         });
       });
@@ -103,13 +112,13 @@ function fetchPublishedVersions({ pkg = CORE_PKG, origin = REGISTRY_ORIGIN, time
 
 // Process-local cache. Deliberately not a table: it is a derived fact with a
 // six-hour life, and a restart re-deriving it costs one request.
-const cache = { at: 0, versions: [], ok: false, inflight: null };
+const cache = { at: 0, versions: [], released: null, ok: false, inflight: null };
 
 
 
 async function publishedVersions({ now = Date.now, ttlMs = TTL_MS, fetch = fetchPublishedVersions, store = cache } = {}) {
   const t = now();
-  if (store.ok && t - store.at < ttlMs) return { ok: true, versions: store.versions, cached: true };
+  if (store.ok && t - store.at < ttlMs) return { ok: true, versions: store.versions, released: store.released, cached: true };
   // IN-FLIGHT DE-DUPE. Without it, every request arriving during a cold-cache
   // window starts its OWN registry read — the cache only collapses them once the
   // first one has landed. Small, because the audience is archon-only and the TTL
@@ -119,8 +128,8 @@ async function publishedVersions({ now = Date.now, ttlMs = TTL_MS, fetch = fetch
   store.inflight = (async () => {
     try {
       const r = await fetch();
-      if (r.ok) { store.ok = true; store.at = t; store.versions = r.versions; }
-      return { ok: r.ok, versions: r.versions, cached: false, error: r.error };
+      if (r.ok) { store.ok = true; store.at = t; store.versions = r.versions; store.released = r.released || null; }
+      return { ok: r.ok, versions: r.versions, released: r.released || null, cached: false, error: r.error };
     } finally {
       store.inflight = null;
     }
@@ -141,7 +150,7 @@ async function publishedVersions({ now = Date.now, ttlMs = TTL_MS, fetch = fetch
 async function readCoreUpdate({ running, channel, get, ...deps } = {}) {
   const fetch = deps.fetch || (get ? () => fetchPublishedVersions({ get }) : fetchPublishedVersions);
   const r = await publishedVersions({ ...deps, fetch });
-  return coreUpdateVerdict({ running, available: r.ok ? r.versions : [], channel });
+  return coreUpdateVerdict({ running, available: r.ok ? r.versions : [], released: r.ok ? r.released : null, channel });
 }
 
 // readCoreUpgrades — the instance's own core-upgrade ledger, newest first: when the

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.79'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.81'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');